Executive brief
Continue is an open-source AI code assistant. A security flaw in its internal file-listing tool allows a local attacker or a malicious AI prompt to bypass security boundaries and view the names of files and folders anywhere on the host computer, such as system configuration files or SSH keys. This could lead to the exposure of sensitive information about the user's system layout and installed software.
Technical details
A path traversal vulnerability exists in the `lsTool` component of the Continue Core JSON-RPC server. The root cause is the omission of the `throwIfFileIsSecurityConcern` validation check in `core/tools/implementations/lsTool.ts`, combined with an explicit override of default ignore patterns (`overrideDefaultIgnores`). An attacker can exploit this by sending a crafted JSON-RPC message to the local TCP port (default 3000) or via prompt injection to list the contents of sensitive directories like `/etc/` or `~/.ssh/`. While the NVD/VulDB reports a CVSS of 3.3 (Low), the researcher suggests a higher impact due to the bypass of security constraints. No official patch was confirmed at the time of disclosure.
Affected products
- continuedev Continue up to 1.2.22
Timeline
- 2026-04-23: disclosed: Researcher published technical details and PoC on GitHub Gist
- 2026-05-18: advisory: CVE-2026-8770 published